Solved

Ports! Can't live with 'em can't live without 'em. But which ones, eh?

Posted on 2007-04-02
4
183 Views
Last Modified: 2010-04-19
I have been guilty, on occasion,  of following advice from EE without paying too much attention. Particularly when it comes to ports. Can we establish some rule-of-thumb typical standards for SBS-2003? Which ports should ALWAYS be closed? Which ports should typically be open for a SBS-2003 server used as such:

A   2x NIC DC with exchange no VPN no FTP no remote web/email
B    2x NIC DC with exchange with remote web/email no VPN no FTP
C   2x NIC DC with exchange with remote web/email with VPN no FTP
D   is FTP ever a good idea on a SBS?
E should port 80 ever be open?

I realize there maybe no definitive
0
Comment
Question by:hgj1357
  • 2
4 Comments
 
LVL 95

Accepted Solution

by:
Lee W, MVP earned 150 total points
ID: 18841183
The simple answer:

ALL Ports should always be closed
ALL Ports required to provide services on the internet should be open

IF you have an appropriate plug and play router, SBS will open the necessary ports for you.

A) Port 25
B) Port 25, 443, possibly port 80
C) Port 25, 443, 1723, possibly port 80
D) FTP in general is not a good idea.  Passwords are transferred in clear text, the data is completely unencrypted.  If you need an FTP site, allow it to be for external downloads only - do not permit uploads and only allow anonymous access. FTP can be scripted EASILY and used as a method for obtaining passwords.
E) If you want to run a publicly accessibly web site, yes.  And I believe if you open it with RWW in use, it would forward you to an HTTPS site.  Keep in mind, while every port that is open is a place to attack, IIS 6 has been a very secure product in comparison to other products, even Apache.  IT's not bulletproof, but it's not an eggshell either.
0
 
LVL 15

Assisted Solution

by:MarkMichael
MarkMichael earned 100 total points
ID: 18841919
The only port I ever (grudgingly) open up is HTTPS (tcp/443) for secure OWA access. I prefer to do everything else via VPN.
0
 
LVL 2

Author Comment

by:hgj1357
ID: 18971541
I was hoping this would develop into a good discussion on ports.

i.e. different ports may be open one one NIC, and closed on the other.

Every port should be open on the routers. Or maybe not.

I understand if there is less enthusiasm there than there is here.
0
 
LVL 15

Assisted Solution

by:MarkMichael
MarkMichael earned 100 total points
ID: 18971942
From a security perspective, open ports = bad; it's really that simple. It's not infeasible to think that someone, somewhere, someday will write an exploit that addresses a service you have open to the Internet.
All we can do to mitigate that threat is to have as few services open to the Internet as possible and make sure they are patched to the hilt :)
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Because virtualization becomes more and more common, and, with Microsoft Hyper-V included in Windows Server at no additional costs, and, most server hardware nowadays is more than capable of running a physical Small Business Server (SBS) 2008 or 201…
You may have discovered the 'Compatibility View Settings' workaround for making your SBS 2008 Remote Web Workplace 'connect to a computer' section stops 'working around' after a Windows 10 client upgrade.  That can be fixed so it 'works around' agai…
This Micro Tutorial will give you a basic overview how to record your screen with Microsoft Expression Encoder. This program is still free and open for the public to download. This will be demonstrated using Microsoft Expression Encoder 4.
Video by: Mark
This lesson goes over how to construct ordered and unordered lists and how to create hyperlinks.

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now